Remote OS Command Injection in Shibby Tomato

Shibby Tomato version 1.28.0000 contains a critical vulnerability involving OS command injection within the new_qoslimit_stop function located in the script /tmp/qoslimittc_stop.sh. An attacker can reach this function by providing malicious input to the wan_iface argument. Because this script executes system-level commands, manipulating this input allows for arbitrary command execution on the underlying Linux-based networking device. This vulnerability is of significant concern as the affected software is widely deployed on home and small-office wireless routers. The project has been superseded by FreshTomato, and users are advised to migrate, as no patches are expected for this legacy firmware. Publicly available exploit proof-of-concept code has been disclosed, increasing the likelihood of opportunistic exploitation in the wild.

Attack Chain

1. The attacker identifies a target device running the legacy Shibby Tomato firmware version 1.28.0000.
2. The attacker gains access to the administrative web interface of the router (or interacts with the interface if exposed to the WAN).
3. The attacker identifies the request handler responsible for triggering QoS settings, specifically targeting the new_qoslimit_stop function.
4. The attacker crafts an HTTP request containing an injected payload within the 'wan_iface' parameter.
5. The web server process passes the attacker-supplied input directly to the /tmp/qoslimittc_stop.sh shell script without sufficient sanitization.
6. The shell script executes the payload with the privileges of the web service account.
7. The attacker establishes a reverse shell or executes secondary payloads to maintain persistence or exfiltrate configuration data.
8. The final objective is full compromise of the networking device to facilitate man-in-the-middle attacks or lateral movement within the local network.

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands with elevated privileges on the target router. This provides complete control over the device, enabling traffic interception, password extraction, configuration modification, and the use of the router as a pivot point for further attacks on the internal network. Given the ubiquity of these devices, this vulnerability poses a high risk to small-office and residential environments.

Recommendation

Prioritized actions for security operations and IT management:

• Migrate all devices currently running Shibby Tomato 1.28.0000 to the active FreshTomato distribution or other supported firmware as the project is superseded.
• Disable remote management access on the router's web interface to mitigate external exploitation risks (CVE-2026-19034).
• Monitor firewall logs for unexpected outbound traffic from router management interfaces to unknown remote endpoints.